Cisco has released patches for CVE-2026-76418 in Secure Firewall ASA and FTD, and confirmed active exploitation.
The flaw involves Remote Access SSL VPN logic when secondary authentication is configured on a tunnel group.
An unauthenticated remote attacker can trigger unexpected device reloads, causing denial of service.
Exposure also requires a vulnerable release and a reachable VPN login service.
The issue affects Secure Firewall ASA and Secure Firewall FTD software and is located in the Remote Internet Connection service. When secondary authentication is enabled on a connection pool, a specially crafted request may cause the device to unexpectedly reboot. This results in the device crashing and causing a temporary outage of service.
The company received information about actual attacks in October 2026, without, however, releasing details about exactly when the attacks began, who is behind them, or the extent of the problem.
Who is at risk?
For a device to be exposed to risk, specific conditions must be met:
- Running a vulnerable version of Cisco Secure Firewall ASA or FTD software.
- The connection service must be accessible from the internet.
- Secondary authentication must be configured in the connection group.
The solution and temporary actions
Cisco has already released fixes for the affected versions of its software and urges administrators to immediately update their systems.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Palo Alto Networks warns of attacks on network tools
↗
For those who cannot update the software immediately, the company suggests temporary solutions, such as disabling the connection group list or disabling secondary identification in the affected groups.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)